CVE-2026-116779criticalCWE-749CWE-77CWE-78

CVE-2026-116779: critical vulnerability in signalwire freeswitch

FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

Published · Updated

Follow this CVE+ Monitor freeswitch

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 1.3%
from disclosure to weaponsame day
Published on NVDNov 5
1st PoCNov 1
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
signalwire · freeswitch
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — signalwire freeswitch

In the same product, most dangerous first.

CVE-2021-37624HIGHFreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofingEPSS 3.8%CVE-2021-41105HIGHFreeSWITCH susceptible to Denial of Service via invalid SRTP packetsEPSS 2.5%CVE-2021-41157MEDIUMFreeSWITCH does not authenticate SIP SUBSCRIBE requests by defaultEPSS 1.7%CVE-2021-41145HIGHFreeSWITCH susceptible to Denial of Service via SIP floodingEPSS 1.7%CVE-2023-51443HIGHFreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 1.5%CVE-2026-116785CRITICALFreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handlingEPSS 1.0%